feat(ui): add maintenance page for task management

* Implement maintenance page with task and log display
* Add backfill and metadata retry functionality
* Integrate grid component for project display in thoughts page
* Update types for maintenance tasks and logs
* Enhance sidebar and shell for new maintenance navigation

internal/app/admin_actions.go

@@ -0,0 +1,79 @@
+package app
+
+import (
+	"encoding/json"
+	"log/slog"
+	"net/http"
+
+	"git.warky.dev/wdevs/amcs/internal/tools"
+)
+
+type adminActions struct {
+	backfill *tools.BackfillTool
+	retry    *tools.EnrichmentRetryer
+	logger   *slog.Logger
+}
+
+func newAdminActions(backfill *tools.BackfillTool, retry *tools.EnrichmentRetryer, logger *slog.Logger) *adminActions {
+	return &adminActions{
+		backfill: backfill,
+		retry:    retry,
+		logger:   logger,
+	}
+}
+
+func (a *adminActions) backfillHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			w.Header().Set("Allow", http.MethodPost)
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+
+		var in tools.BackfillInput
+		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+			http.Error(w, "invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		_, out, err := a.backfill.Handle(r.Context(), nil, in)
+		if err != nil {
+			if a.logger != nil {
+				a.logger.Warn("admin backfill failed", slog.String("error", err.Error()))
+			}
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(out)
+	})
+}
+
+func (a *adminActions) retryMetadataHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			w.Header().Set("Allow", http.MethodPost)
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+
+		var in tools.RetryEnrichmentInput
+		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+			http.Error(w, "invalid request body", http.StatusBadRequest)
+			return
+		}
+
+		_, out, err := a.retry.Handle(r.Context(), nil, in)
+		if err != nil {
+			if a.logger != nil {
+				a.logger.Warn("admin metadata retry failed", slog.String("error", err.Error()))
+			}
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(out)
+	})
+}

internal/app/app.go

@@ -191,6 +191,7 @@ func routes(logger *slog.Logger, cfg *config.Config, info buildinfo.Info, db *st
 	filesTool := tools.NewFilesTool(db, activeProjects)
 	enrichmentRetryer := tools.NewEnrichmentRetryer(context.Background(), db, bgMetadata, cfg.Capture, cfg.AI.Metadata.Timeout, activeProjects, logger)
 	backfillTool := tools.NewBackfillTool(db, bgEmbeddings, activeProjects, logger)
+	adminActions := newAdminActions(backfillTool, enrichmentRetryer, logger)
 
 	toolSet := mcpserver.ToolSet{
 		Capture:       tools.NewCaptureTool(db, embeddings, cfg.Capture, activeProjects, enrichmentRetryer, backfillTool),
@@ -236,6 +237,8 @@ func routes(logger *slog.Logger, cfg *config.Config, info buildinfo.Info, db *st
 	mux.HandleFunc("/api/oauth/register", oauthRegisterHandler(dynClients, logger))
 	mux.HandleFunc("/api/oauth/authorize", oauthAuthorizeHandler(dynClients, authCodes, logger))
 	mux.HandleFunc("/api/oauth/token", oauthTokenHandler(oauthRegistry, tokenStore, authCodes, logger))
+	mux.Handle("/api/admin/actions/backfill", authMiddleware(adminActions.backfillHandler()))
+	mux.Handle("/api/admin/actions/retry-metadata", authMiddleware(adminActions.retryMetadataHandler()))
 	mux.HandleFunc("/favicon.ico", serveFavicon)
 	mux.HandleFunc("/images/project.jpg", serveHomeImage)
 	mux.HandleFunc("/images/icon.png", serveIcon)

internal/app/resolvespec_admin_test.go

@@ -61,6 +61,7 @@ func TestResolveSpecGuardAllowsSupportedMutations(t *testing.T) {
 		entity    string
 		operation string
 	}{
+		{name: "learnings read", entity: "learnings", operation: "read"},
 		{name: "projects create", entity: "projects", operation: "create"},
 		{name: "thoughts update", entity: "thoughts", operation: "update"},
 		{name: "thoughts delete", entity: "thoughts", operation: "delete"},
@@ -119,6 +120,13 @@ func TestResolveSpecGuardBlocksUnsupportedMutations(t *testing.T) {
 			wantCode:      http.StatusForbidden,
 			wantMessageIn: `operation "delete" is not allowed for public.stored_files`,
 		},
+		{
+			name:          "mutations blocked for learnings",
+			entity:        "learnings",
+			operation:     "delete",
+			wantCode:      http.StatusForbidden,
+			wantMessageIn: `operation "delete" is not allowed for public.learnings`,
+		},
 		{
 			name:          "unknown operation is rejected",
 			entity:        "projects",
@@ -152,3 +160,13 @@ func TestResolveSpecGuardBlocksUnsupportedMutations(t *testing.T) {
 		})
 	}
 }
+
+func TestResolveSpecModelsIncludeLearnings(t *testing.T) {
+	models := resolveSpecModels()
+	for _, model := range models {
+		if model.schema == "public" && model.entity == "learnings" {
+			return
+		}
+	}
+	t.Fatal("resolveSpecModels() missing public.learnings")
+}

internal/app/status.go

@@ -25,6 +25,7 @@ type statusAPIResponse struct {
 	TotalKnown      int                   `json:"total_known"`
 	ConnectedWindow string                `json:"connected_window"`
 	Entries         []auth.AccessSnapshot `json:"entries"`
+	Metrics         auth.AccessMetrics    `json:"metrics"`
 	OAuthEnabled    bool                  `json:"oauth_enabled"`
 }
 
@@ -40,6 +41,7 @@ func statusSnapshot(info buildinfo.Info, tracker *auth.AccessTracker, oauthEnabl
 		TotalKnown:      len(entries),
 		ConnectedWindow: "last 10 minutes",
 		Entries:         entries,
+		Metrics:         tracker.Metrics(20),
 		OAuthEnabled:    oauthEnabled,
 	}
 }

internal/app/status_test.go

@@ -49,6 +49,15 @@ func TestStatusSnapshotShowsTrackedAccess(t *testing.T) {
 	if snapshot.Entries[0].KeyID != "client-a" || snapshot.Entries[0].LastPath != "/files" {
 		t.Fatalf("entry = %+v, want keyID client-a and path /files", snapshot.Entries[0])
 	}
+	if snapshot.Metrics.TotalRequests != 1 {
+		t.Fatalf("Metrics.TotalRequests = %d, want 1", snapshot.Metrics.TotalRequests)
+	}
+	if snapshot.Metrics.UniqueIPs != 1 {
+		t.Fatalf("Metrics.UniqueIPs = %d, want 1", snapshot.Metrics.UniqueIPs)
+	}
+	if snapshot.Metrics.UniqueAgents != 1 {
+		t.Fatalf("Metrics.UniqueAgents = %d, want 1", snapshot.Metrics.UniqueAgents)
+	}
 }
 
 func TestStatusAPIHandlerReturnsJSON(t *testing.T) {